1. Field of the Invention
The present invention is directed to the protection of encryption keys in a database.
2. Background Art
In recent years there have been numerous incidents of identity theft and credit card fraud resulting in damages reaching into the hundreds of millions of dollars. As a result, protection against such threats is a priority of any business that handles confidential user data.
Retailers, online merchants, universities and health care organizations are tightening security around personally identifiable information (PII) such as social security numbers. Merchants and service providers who process credit card data are required to comply with the Payment Card Industry Data Security Standard (PCI-DSS).
The Payment Card Industry Data Security Standard (PCI-DSS) is a set of requirements for payment card security, authored by the PCI Security Standards Council and includes requirements for security management, policies, procedures, network architecture, software design and other critical protective measures.
One way of protecting data and complying with PCI-DSS is by using encryption techniques on databases that store the data. Encryption is important for protecting data in transit and at rest. By using encryption, even if an intruder or any other threat circumvents other network security controls and gains access to encrypted data, without the proper cryptographic keys, the data is unreadable and unusable to that person.
Accordingly, systems, methods and computer program products are needed that offer robust methods of key encryption while complying with security standards that may exist, such as, but not limited to, PCI-DSS.